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DETAILED ACTION 

Response to Arguments 

1. In response to communications filed on 6/10/2005, Applicant cancels claims 2-4 and 20- 
22; and amends claims 1, 31, and 60. Applicant adds claims 77-82. The following claims 1, 6, 
9, 12-14, 19, 24, 27, 30-32, 45, 52, 53 and 55-82 are presented for examination. 

1 . 1 Applicant's remarks, pages 19-28, filed on 6/10/2005, with respect to the rejection of 
claims 1-76 have been fully considered, but they are not persuasive. Applicant mentions that 
claim 19 has been amended, on the other hand claim 19 has not been amended and it is still 
objected for lack of definiteness. With regard to claim 1, applicant argues that Calvignac does 
not disclose "sequentially performing rule operations in a given rule of the selected set of rules 
until performing a disregard instruction, the disregard instruction including disregard criteria 
identifying a type of other rule operations in the selected set of rules to disregard from 
performing". Examiner respectfully disagrees. As disclosed in the office action, Calvignac 
discusses the above in at least the embodiment of figures 3 A-3D, Calvignac discloses minimum 
and maximum values for the filter rules are used to determine subsets of rules, once the subsets 
of the filter rules are obtained the IP address is tested against each of the subsets to determine 
which if any of the rules for each subset there is a match. . . filter rules in the first subset and 
corresponding dimension are disregarded when forming further subsets, remaining filter rules 
and dimensions are used. . . a next subset is selected and both the filter rules and dimensions are 
disregarded in that subset (column 6, line 14 through column 7, line 48). Figures 3C-3D also 
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cites "if more than one filter rule shares the same minimum value then one filter rule is selected 
as being part of the subset and the other filter rules sharing the minimum value are discarded for 
the dimension" that meets the recitation of the disregard instruction including disregard criteria 
identifying a type of other rule operations in the selected set of rules to disregard from 
performing. Calvignac further discloses performing a sweep to determine whether minimum 
values for a filter rule has been encountered. . . determine whether minimum value is encountered 
before maximum value of the selected filter rule is reached; if minimum value for another filter 
rule is encountered then the filter rule is disregarded. . . any filter rule which intersects the 
selected filter rule is disregarded (column 7, line 47 through column 8, line 47). See also 
embodiment using a decision tree (figure 5). Calvignac also uses a decision tree to isolate a 
portion of plurality of filter rules on a leaf path having at least one node (column 3, lines 49-53; 
column 10, lines 1-14). Applicant states "there is no discussion about executing the rules 
whatsoever" while at the same time concedes on a previous paragraph "Calvignac is to more 
quickly select which rules shall be applied prior to actual execution or performance of the rules". 
As discussed above and throughout the reference, rule processing is being discussed and 
according to applicant's disclosure, rule processing and rule performing or executing are all- 
synonymous. With regard to claims 45, 52, 53, and 58, as discussed above, Calvignac discloses 
the step of selecting and performing rule operations and further discloses non-performance of at 
least one rule operation in the rule that is disregarded; in another embodiment, (see figure 5 with 
explanation), in the example of figure 5, rule 4 or 5 is disregarded. In response to applicant's 
statement that Calvignac only performs a two-stage selection process to determine rules to apply, 
Calvignac provides explanation of the invention of performing rule operations and processing 
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rules using an access control decision tree; see column 4, lines 20-57; also, as discussed above 
and in Calvignac's claims the rule processing disclosed reduces the amount of rules to be 
applied; a decision tree allows reduction of set of rules to only one possible rule or small set of 
possible rules. Claim 70 contains similar limitations as discussed above with respect to claim 1. 
Applicant's arguments fail to address the citation of the reference from the last office action but 
instead amount to a general allegation that the reference does not teach the claim limitations; in 
addition, applicant's arguments page 21 falsely indicates that Examiner relies in column 8, lines 
24-47 in the rejection of claim 1, there is no such indication in the last office action. Applicant's 
arguments fail to comply with 37 CFR 1. 1 1 1(b) because they amount to a general allegation that 
the claims define a patentable invention without specifically pointing out how the language of 
the claims patentably distinguishes them from the references. 

In view of the above and in view of the rejection in the last office actions, applicant has 
not overcome the rejection. Applicant adds new claims with new limitations. However, the 
claim limitations introduced new matter, which will be further discussed above. Claims are still 
rejected in view of Calvignac. 

Claim Rejections - 35 USC § 112 
2. The following is a quotation of the first paragraph of 35 U.S. C. 112: 

The specification shall contain a written description of the invention, and of the manner 
and process of making and using it, in such full, clear, concise, and exact terms as to enable any 
person skilled in the art to which it pertains, or with which it is most nearly connected, to make 
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and use the same and shall set forth the best mode contemplated by the inventor of carrying out 
his invention. 

2.1 Claims 77, 81 and the intervening claims are rejected under 35 U.S.C. 112, first 
paragraph, as failing to comply v^ith the written description requirement. The claim contains 
subject matter, which was not described in the specification in such a way as to reasonably 
convey to one skilled in the relevant art that the inventor(s), at the time the application was filed, 
had possession of the claimed invention. Applicant's disclosure fails to recite prior to selecting 
the second rule and after executing the first rule, executing rule operations in the first rule 
including the disregard instruction: and prior to selecting the second rule and after executing the 
first rule, executing a respective filter operation associated with the second rule . The 
specification, on the other hand, page 34, describes that filter operations are used to pre-select 
which rules apply to certain criteria and fiirther discloses filter operations are used to select rule 
operations which will then be further processed. In applicant's disclosure, all rules to be 
processed are pre-selected based on a filter processing (see also page 38, lines 4-5 and page 38, 
line 30 through page 39, line 1); "filter operations might select all rules that apply to the resource 
requested or only those rules that apply to a specific role or to a type of access requested. The 
system then applies the access request against the selected set of rules" (page 16, lines 1-8; 
"selected set of rules (initially selected via filter operations)" as stated on page 16, line 17. 
Therefore, the limitations above represent new matter. 
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Claim Objections 

3. Claim 19 is objected to because of the following informalities: after performing "the 
unconditional" should be -an unconditional disregard or —the disregard instruction-. To 
avoid rendering the claim indefinite, appropriate correction is requested. 



Claim Rejections - 35 USC § 102 

4. A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for patent by another 
filed in the United States before the invention thereof by the applicant for patent, or on an 
international application by another who has fulfilled the requirements of paragraphs (1), 
(2), and (4) of section 371(c) of this title before the invention thereof by the applicant for 
patent. 

The changes made to 35 U.S.C. 102(e) by the American Inventors Protection Act of 1999 
(AIPA) and the Intellectual Property and High Technical Amendments Act of 2002 do not 
apply when the reference is a U.S. patent resulting directly or indirectly from an international 
apphcation filed before November 29, 2000. Therefore, the prior art date of the reference is 
determined under 35 U.S.C. 102(e) prior to the amendment by the AIPA (pre- AIPA 35 U.S.C. 
102(e)). 



4 1 Claims 1, 6, 9, 12-14, 19, 24, 27, 30-32, 45, 52, 53 and 55-82 are rejected under 35 
U.S.C. 102(e) as being anticipated by US Patent 6,539,394 to Calvignac et al. 



4.2 As per claims 1, 19, Calvignac et al discloses a method and a system (see figure 1) that 
meets the recitation of the system of claim 19 comprising input/output interface, processor. 
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memory system encoding with authorization program, authorization database, and 
interconnection mechanism coupling the above list, for providing access control in a computing 
system environment, the method/system comprising the steps of receiving an access request, for 
example (see column 1, lines 30-67); selecting, based on the access request, a selected set of 
rules containing at least one rule from a master set of rules, for example (see column 1, line 30 
through column 2, line 22 and column 3, lines 25-56); and producing an access control decision 
based on performing rule operations in a given rule of the selected set of rules by sequentially 
performing rule operations in the given rule until performing a disregard instruction, the 
disregard instruction including disregard criteria identifying a type of other rule operations in the 
selected set of rules to disregard from performing, for example (see column 3, lines 25-56 and 
figures 3 A-3D); Calvignac et ai provides detailed explanation of figures 3 A-3D in columns 6-8 
in performing a disregard instruction including disregard criteria identifying a type of other rule 
operations in the selected set of rules to disregard from performing that meets the recitation of 
claims 1, and 19 (see for instance column 7, line 49 through column 8, line 47). Calvignac et al 
also after performing the unconditional disregard instruction in the given rule: evaluating the 
disregard criteria against any remaining unperformed rule operations in other rules of the 
selected set of rules, the other rules being rules other than the given rule: ii) marking any 
remaining unperformed rule operations in the other rules of the selected set of rules that match 
the disregard criteria to be disregarded from further rule processing, for example (see column 7, 
lines 5-32; column 7, line 49 through column 8, line 47 and figures 3A-3D); and iii) executing 
remaining unmarked rule operations in the other rules in the selected set of rules, for example 
(see column 7, line 49 through column 8, line 47 and figures 3 A-3D). 
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As per claim 45, Calvignac et al discloses a method for controlling applicability of rule 
operations in a rule-based access control system, the method comprising the step of selecting at 
least two rules for performance to determine an access control decision, the at least two rules 
including a first rule and a second rule, for example (see column 7, line 49 through column 8, 
line 47 and figures 3 A-3D); Calvignac et al discloses at least one rule operation in the second 
rule other than the disregarded rule operation is performed that meets the recitation of 
performing a rule operation in the first rule of the at least two rules, the rule operation including 
a disregard instruction that when performed, causes non-performance of at least one other rule 
operation in the second that is disregarded based on the disregard instruction and performing at 
least one rule operation in the second rule other than the at least one rule operation in the second 
rule that is disregarded, for example (see column 7, line 49 through column 8, line 47 and figures 
3A-3D). 

Claim 52 recites similar limitation as claim 45 except for limiting performance to fewer 
than all rule operations in a second rule of the selected set of rules. Calvignac et al also discloses 
that some of the rules not all will still be performed in a second rule of the selected set of rules, 
for example (see column 7, line 49 through column 8, line 47 and figures 3 A-3D). Therefore, 
claim 52 is rejected on the same rationale as the rejection of claim 45. 

Claims 58 and 63, recite the same inventive concept as claims 1, 45, and 52. Therefore, 
they are rejected on the same rationale as the rejection of claims 1, 45, and 52. The step of 
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performing a conditional disregard by disregarding execution of at least one rule of at least one 
rule operation other than the conditional disregard rule is disclosed in column 7, line 49 through 
column 8, line 47 as well as performing at least one other rule in the set of rules not specified in 
the disregard criteria after performing the conditional disregard rule. 

As per claims 70 and 76, Calvignac et al discloses a method for providing access 
control in a computing system environment, the method comprising: receiving an access request 
to access data in the computing system environment, for example (see column 1, lines 30-67); 
comparing the access request to a master rule set, each rule in the master rule set including a 
filter and a corresponding set of rule operations to be performed pending evaluation of the filter 
condition, for example (see column 4, lines 21-57; and column 1, line 30 through column 2, line 
22 and figures 3 A-3D with detailed explanation in 6-8); and for each rule containing a filter 
operation that evaluates to indicate execution of rule operations of that rule, executing the rule 
operations of that rule, for example (see figures 3 A-3D with detailed explanation in columns 6- 
8); during execution of rule operations of that rule, executing a first conditional disregard 
instruction that establishes a first set of pre-conditions that must be met in successive rules in the 
master rule set in order for those successive rules to be executed after the rule containing the first 
conditional disregard instruction has been executed, for example (see column 7, line 49 through 
column 8, line 47, see also embodiment illustrated in figure 5; figures 3 A-3D with detailed 
explanation in columns 6-8); and executing at least one successive rule in the master rule set for 
which the access request meets the filters of those successive rules, and for which the first set of 
pre-conditions established by executing the first conditional disregard instruction are also met. 
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for example (see column 7, line 49 through column 8, line 47, see also exemplary embodiment 
with respect to decision tree as illustrated in figure 5; figures 3 A-3D; with detailed explanation o 
columns 6-8). 

As per claims 6 and 24, Calvignac et al discloses the limitation of wherein the selected 
set of rules is arranged hierarchically such that rules containing rule operations that are more 
specific are performed before rule operations that are more general, for example (see column 7, 
lines 49 through column 8, line 23; and column 3, lines 20-56; column 6, lines 34-62), 

As per claims 9 and 27, Calvignac et al discloses the limitation of wherein the step of 
selecting includes the steps of determining an identity of a resource in the computing system 
environment to which access is requested in the access request, for example (see column 4, lines 
21-57; and column 1, line 30 through column 2, line 22); and applying at least one filter 
operation, using the identity of the resource, for rules in the at least one master set of rules to 
produce the selected set of rules for use in determining the access control decision to the 
resource, for example (see column 4, lines 21-57; and column 1, line 30 through column 2, line 
22); and wherein the method further includes the step of determining a role identity of a 
requestor submitting the access request, for example (see column 4, lines 21-57; and column 1, 
line 30 through column 2, line 22); and wherein the step of performing includes sequentially 
processing each rule operation in the selected set of rules using the role identity of the requestor 
submitting the access request in combination with the identity of the resource to determine if the 
requestor using the role identity can access the resource, for example (see column 4, lines 21-57; 
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and column 1, line 30 through column 2, line 22; and column 7, line 49 through column 8, line 
23; and column 3, lines 20-56; column 6, lines 34-62); 

As per claims 12 and 30, Calvignac et al discloses the limitation of wherein the selected 
set of rules is arranged hierarchically such that rules containing rule operations that are more 
specific are performed before rules containing rule operations that are more general such that 
placement of the disregard instruction in one of the at least one rules in the selected set of rules 
causes the step of performing to control an amount of access control provided to the requestor 
that submitted the access request for access to a respective resource, for example (see column 7, 
lines 49 through column 8, Hne 23; and column 3, lines 20-56; column 6, lines 34-62). 

As per claims 13 and 31, Calvignac et al discloses the limitation of wherein the 
disregard instruction is a conditional instruction that has a condition that must be met before the 
disregard instruction is performed, for example (see column 7, lines 49-67). 

As per claims 14 and 32, Calvignac et al discloses in one embodiment an example of a 
group of system administrators that meet the recitation of the limitation of wherein at least one 
rule in the selected set of rules contains a relation that defines a condition based on a group 
definition; and wherein at least one of the steps of selecting and performing includes the step of 
performing the relation to determine if at least one of a requestor, an access, and a resource 
specified in the access request satisfy the condition based on the group definition, for example 
(see column 4, Hnes 21-57). 
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As per claim 53, Calvignac et al discloses the limitation of wherein the filter operation 
is an IF-THEN operation and performance of the IF-THEN operation provides an indication 
whether to perform at least one of the multiple rule operations in the first rule, for example (see 
column 7, line 49 through column 8, line 23). 

As per claim 55, Calvignac et al discloses the limitation of wherein the disregard 
instruction is a conditional disregard instruction, which limits a performance of other rule 
operations in multiple rules other than the first rule in the selected set of rules depending on 
occurrence of a corresponding condition as specified by the disregard criteria in the disregard 
instruction, for example (see column 7, line 49 through column 8, Une 47). 

As per claim 56, Calvignac et al discloses the limitation of performing at least one 
other rule operation in the first rule as well as other rules in the selected set of rules after 
performing the conditional disregard instruction, for example (see column 7, line 49 through 
column 8, line 47, see also embodiment illustrated in figure 5; and figures 3 A-3D). 

As per claim 57, Calvignac et al discloses the limitation of wherein performance of the 
IF-THEN operation includes identifying whether an application generating the access request 
uses a particular resource in the storage system as well as whether a requestor associated with the 
access request is a member of a particular specified group and, if so, performing the rule 
operations in the first rule, for example (see column 4, lines 21-57). 
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As per claim 59, Calvignac et al discloses the limitation of comparing disregard criteria 
in a data field associated with the conditional disregard rule operation to data in other rule 
operations to identify which other rule operations in the selected set of rules to disregard from 
performance, for example (see column 8, lines 24-47 and figures 3 A-3D). 

As per claim 60, Calvignac et al discloses the limitation of wherein a field of data in the 
conditional disregard rule operation specifically identifies a first type of rule operations that are 
to be disregarded from execution in the set of rules, execution of the conditional disregard rule 
not having any affect on whether to perform a second type of rule operations in the set of rules, 
for example (see column 8, lines 24-47). 

Claim 61 recites the same inventive concept as claim 1 and is rejected on the same 
rationale as the rejection of claim 1. 

As per claim 62, Calvignac et al discloses the limitation of using exact match that will 
that results in termination of performing any other rule operations in the selected set of rules and 
further discloses combining exact matches with ranges of values that meets the recitation of 
further comprising during processing of the set of rules, performing an unconditional disregard 
rule operation in the set of rules that results in termination of performing any other rule 
operations in the selected set of rules, for example (see column 2, lines 40-45 and column 5, lines 
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28-35; column 7, line 49 through column 8, line 47; see also exemplary embodiment with respect 
to decision tree as illustrated in figure 5). 

As per claim 64, Calvignac et al discloses the Umitation of wherein selecting the first set 
of rules and the second set of rules includes applying a respective first filter and a second filter to 
identify whether to select the first set of rules and the second set of rules for execution, for 
example (see column 8, lines 23-47; and column 6, lines 34-62). 

As per claim 65, Calvignac et al discloses the limitation of after disregarding execution 
of at least one rule operation in the second set of rules as identified by the disregard rule 
operation in the first set of rules, performing at least one rule operation in the second set of rules 
not associated with the disregard rule operation, for example (see column 8, lines 24-47 and 
figures 3A-3D). 

As per claim 66, Calvignac et al discloses the limitation of following completion of 
executing the first set of rules and the second set of rules, generating an access control decision 
whether to permit the access request, for example (see column 8, lines 24-47 and figures 3 A-3D). 

As per claims 67-69, claims 67-69 recite the same limitation as claims 60-62 
respectively except for using a first and second set of rules instead of set of rules. Calvignac et 
al discloses the invention with multiple sets of rules (see rejection of claim 52). Therefore they 
are rejected on the same rationale as the rejection of claims 60-62. 
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As per claim 71, Calvignac et al discloses the limitation of wherein executing only the 
successive rules in the master rule set comprises: executing a second conditional disregard 
instruction that establish a second set of pre-conditions that must also be met in addition to the 
first set of pre-conditions established by the first disregard instruction for any remaining 
successive rules in the master rule set to be executed, for example (see column 8, lines 24-47 and 
figures 3A-3D). 

As per claim 72, Calvignac et al discloses the limitation of wherein pre-conditions 
established by execution of the conditional disregard instructions indicate a type of data upon 
which rule operations of successive rules in the master rule set operate that are not to be executed 
during execution of the successive rules in the master rule set, for example (see column 8, lines 
24-47 and figures 3A-3D). 

As per claim 73, Calvignac et al discloses the limitation of wherein the filter of at least 
one rule in the master rule set includes a test of whether an application associated with the access 
request uses a particular resource associated with the request, for example (see column 4, lines 
21-57; and column 1, line 30 through column 2, line 22). 

As per claim 74, Calvignac et al discloses the limitation of wherein the filter of at least 
one rule in the master rule set includes a test of whether at least two resources associated with the 
access request are connected to each other, for example (see column 4, lines 21-57; and column 
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1, line 30 through column 2, Une 22). Calvignac et al discloses at least two resources connected 
to each other that can be associated with the access request. 

As per claim 75, Calvignac et al discloses the limitation of skipping execution of those 
successive rules in the master rule set for which the access request does not meet the filters of 
those successive rules, and for which the first and second set of pre-conditions established by 
executing the first and second disregard instructions are not met, for example (see column 8, 
lines 24-47 and figures 3A-3D). 

As per claims 77 and 81, Calvignac et al discloses wherein the rule-based access 
control system enables access to a storage resource in a storage area network, the method ftirther 
comprising: prior to selecting the first rule and the second rule, executing a respective filter 
operation associated with the first rule to identify whether to select the first rule and execute rule 
operations in the first rule (column 4, lines 21-57; and column 1, Une 30 through column 2, line 
22); also see column 14, lines 1-43); prior to selecting the second rule and after selecting the first 
rule, executing rule operations in the first rule including the disregard instruction (column 6, line 
62 through column 7, line 15), prior to selecting the second rule and after executing the first rule, 
executing a respective filter operation associated with the second rule to identify whether to 
select the second rule and execute rule operations in the second rule (column 7, lines 15-32); and 
after selecting and executing the first rule and after selecting the second rule, executing rule 
operations in the second rule as well as disregarding execution of at least one rule operation in 
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the second rule based on execution of the disregard instruction in the first rule (column 7, lines 
49 through column 8, line 47). 

As per claim 78, Calvignac et al discloses wherein performing the rule operation in the 
first rule includes performing a conditional disregard instruction that identifies a particular type 
of rule operation to disregard from execution in the selected at least two rules, the method further 
comprising: disregarding execution of a rule operation of the particular type in the second rule 
(column 7, Une 49 through column 8, line 47). 

As per claim 79, Calvignac et al discloses performing a rule operation in the second rule 
that results in termination of a process of sequentially testing whether additional rules apply to 
the access request (column 7, line 49 through column 8, line 47 see also exemplary embodiment 
with respect to decision tree as illustrated in figure 5). 

As per claims 80 and 82, Calvignac et al discloses selecting rules based on type of data 
associated with the access request (column 1) based on access resources based on whether a user 
generating the access request should be allowed or denied access to a particular portion of a 
network that meets the recitation of selectively executing rule operations associated with the first 
rule and the second rule depending on: i) a type of data associated with the access request, ii) an 
amount of space available associated with the storage resource, and iii) a membership class of a 
user generating the access request (see column 4, lines 21-57; and column 1, line 30 through 
column 2, line 22). 
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Conclusion 

5. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

5.1 The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure as the art discloses disregard instructions comprising multiple set of rules. Many of 
the claimed features are present in these references. 

US Patent: 6,385,598 Giacalone et al; 4,754,410 Leech et al; 5,968,176 Nessett et al; 
6,473,763 Corl, Jr.et al; 6,298,340 Calvignac et al. 
US Patent PubUcation : US2004/0 158744 Deng et al; 
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5.2 Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Carl Colin whose telephone number is 571-272-3862. The 
examiner can normally be reached on Monday through Thursday, 8:00-6:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 571-272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
appHcations is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov . Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

Carl Cohn 
Patent Examiner 
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